Commit Graph

693093 Commits

Author SHA1 Message Date
Mauro Carvalho Chehab 3256b36ea3 media: dmx.h: split typedefs from structs
Using typedefs inside the Kernel is against CodingStyle, and
there's no good usage here.

Just like we did at frontend.h, at commit 0df289a209
("[media] dvb: Get rid of typedev usage for enums"), let's keep
those typedefs only to provide userspace backward compatibility.

No functional changes.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-09-05 05:49:45 -04:00
Mauro Carvalho Chehab c93022a72f media: ca.h: split typedefs from structs
Using typedefs inside the Kernel is against CodingStyle, and
there's no good usage here.

Just like we did at frontend.h, at commit 0df289a209 ("[media] dvb:
Get rid of typedev usage for enums"), let's keep those typedefs only
to provide userspace backward compatibility.

No functional changes.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-09-05 05:48:39 -04:00
Sean Young fce4b371fe media: serial_ir: fix tx timing calculation on 32-bit
Move the calculation to where it is needed, so the result doesn't
need to be stored in the device struct.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-31 05:36:42 -04:00
Sean Young 766cbb3189 media: rc: gpio-ir-tx: use ktime accessor functions
Prefer using accessor functions so we are not dependent on the ktime_t
type.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-31 05:35:54 -04:00
Jasmin Jessich 800846c4d9 media: rc: use ktime accessor functions
Prefer using accessor functions so we are not dependent on the ktime_t
type.

Signed-off-by: Jasmin Jessich <jasmin@anw.at>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-31 05:35:18 -04:00
Fabio Estevam 9a45bf28bc media: max2175: Propagate the real error on devm_clk_get() failure
When devm_clk_get() fails we should return the real error code
instead of always returning -ENODEV.

This allows defer probe to happen in the case the clock provider has
not been enabled by the time max2175 driver gets probed.

Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 18:14:11 -04:00
Matthias Schwarzott 82cf5f4f6b media: cx23885: Explicitly list Hauppauge model numbers of HVR-4400 and HVR-5500
Add two new model numbers to suppress this message in kernel log:
  cx23885: cx23885[0]: warning: unknown hauppauge model #121029

Add these model numbers:
* Model 121019 - WinTV-HVR4400
* Model 121029 - WinTV-HVR5500

For WinTV-HVR4400 the documentation and my hardware differ:

Documentation says it supports DVB-S/S2 and DVB-T,
but my hardware also supports DVB-C.

Signed-off-by: Matthias Schwarzott <zzam@gentoo.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 18:13:43 -04:00
Javier Martinez Canillas 61e220adf6 media: i2c: adv748x: Export I2C device table entries as module aliases
The I2C core always reports a MODALIAS of the form i2c:<foo> even if the
device was registered via OF, and the driver is only exporting the OF ID
table entries as module aliases.

So if the driver is built as module, autoload won't work since udev/kmod
won't be able to match the registered OF device with its driver module.

Before this patch:

$ modinfo drivers/media/i2c/adv748x/adv748x.ko | grep alias
alias:          of:N*T*Cadi,adv7482C*
alias:          of:N*T*Cadi,adv7482
alias:          of:N*T*Cadi,adv7481C*
alias:          of:N*T*Cadi,adv7481

After this patch:

modinfo drivers/media/i2c/adv748x/adv748x.ko | grep alias
alias:          of:N*T*Cadi,adv7482C*
alias:          of:N*T*Cadi,adv7482
alias:          of:N*T*Cadi,adv7481C*
alias:          of:N*T*Cadi,adv7481
alias:          i2c:adv7482
alias:          i2c:adv7481

Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 18:12:14 -04:00
Arnd Bergmann 537b5c840c media: staging/imx: always select VIDEOBUF2_DMA_CONTIG
I ran into a rare build error during randconfig testing:

drivers/staging/media/imx/imx-media-capture.o: In function `capture_stop_streaming':
imx-media-capture.c:(.text+0x224): undefined reference to `vb2_buffer_done'
drivers/staging/media/imx/imx-media-capture.o: In function `imx_media_capture_device_register':
imx-media-capture.c:(.text+0xe60): undefined reference to `vb2_queue_init'
imx-media-capture.c:(.text+0xfa0): undefined reference to `vb2_dma_contig_memops'

While VIDEOBUF2_DMA_CONTIG was already selected by the camera driver,
it wasn't necessarily there with just the base driver enabled.
This moves the 'select' statement to the top-level option to make
sure it's always available.

Fixes: 64b5a49df4 ("[media] media: imx: Add Capture Device Interface")

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Steve Longerbeam <steve_longerbeam@mentor.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 18:10:16 -04:00
Bhumika Goyal 651ac1290f media: dw2102: make dvb_usb_device_description structures const
dvb_usb_device_description structures are only used during a copy
operation. Therefore, declare them as const.

Signed-off-by: Bhumika Goyal <bhumirks@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 18:08:55 -04:00
Olli Salonen 2fb0e047f9 media: mn88473: reset stream ID reg if no PLP given
If the PLP given is NO_STREAM_ID_FILTER (~0u) don't try to set that into the PLP register. Set PLP to 0 instead.

Signed-off-by: Olli Salonen <olli.salonen@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 18:06:52 -04:00
Olli Salonen 07d45a42fa media: mn88472: reset stream ID reg if no PLP given
If the PLP given is NO_STREAM_ID_FILTER (~0u) don't try to set that into the PLP register. Set PLP to 0 instead.

Signed-off-by: Olli Salonen <olli.salonen@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 18:06:34 -04:00
Colin Ian King 450694c3b9 media: dvb_frontend: initialize variable s with FE_NONE instead of 0
GIT_AUTHOR_NAME=Colin King
GIT_AUTHOR_EMAIL=colin.king@canonical.com

In a previous commit, we added FE_NONE as an unknown fe_status.
Initialize variable s to FE_NONE instead of the more opaque value 0.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 17:58:44 -04:00
Colin Ian King ae64fe26ac media: docs-next: update the fe_status documentation for FE_NONE
Recently added FE_NONE to the enum fe_status, so update the
documentation accordingly.

[mchehab@s-opensource.com: change description to actually
 reflect what FE_NONE means: no lock of any kind]
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 17:58:05 -04:00
Colin Ian King a9e4998073 media: dvb_frontend: ensure that inital front end status initialized
The fe_status variable s is not initialized meaning it can have any
random garbage status.  This could be problematic if fe->ops.tune is
false as s is not updated by the call to fe->ops.tune() and a
subsequent check on the change status will using a garbage value.
Fix this by adding FE_NONE to the enum fe_status and initializing
s to this.

Detected by CoverityScan, CID#112887 ("Uninitialized scalar variable")

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 17:55:51 -04:00
Mauro Carvalho Chehab f3ee363fc1 media: dvbproperty.rst: minor editorial changes
Do some minor editorial changes to make this chapter visually
better, and the example a little bit clearer.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 09:18:29 -04:00
Mauro Carvalho Chehab 1e1d9c9679 media: dvbproperty.rst: improve notes about legacy frontend calls
The description of the DVBv5 API was written a long time ago,
where the API was still new, and there were not apps using it.

Now that the API is stable and used by new applications, clarify
that DVBv3 calls should not be used and why.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 09:18:12 -04:00
Mauro Carvalho Chehab e9dc0f827f media: frontend.rst: mention MMT at the documentation
The ATSC 3.0 uses MPEG Media Transport, with is not currently
supported. Yet, we'll need to implement it sooner or later.
So, mention about it at the specs.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 09:17:56 -04:00
Mauro Carvalho Chehab 2258ee775f media: frontend.rst: convert SEC note into footnote
The description of what SEC means fits well as a footnote.
That makes the need of saying that SEC is only for Satellite
when it was mentioned, as the footnote already says that.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 09:17:30 -04:00
Mauro Carvalho Chehab 3430b8e9aa media: frontend.rst: fix supported delivery systems
The introduction for the frontend chapter is not quite
correct:
  - it tells that it supports only three types of
    delivery systems, in opposite to three *groups*;
  - It adds ISDB-C to the list of supported systems,
    but, this is not true.

Fix it.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 09:17:12 -04:00
Mauro Carvalho Chehab e5707c9abf media: dvb/intro.rst: Use verbatim font where needed
The device numbering for DVB uses "M" and "N" as vars for the
number of the device, but sometimes this is printed using normal
font instead of verbatim.

While here, remove an extra space after quotation marks.

This is a minor cleanup with no changes at the text.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 09:15:48 -04:00
Markus Elfring 1fbfd8c13a media: usbvision: Improve a size determination in usbvision_alloc()
Replace the specification of a data structure by a pointer dereference
as the parameter for the operator "sizeof" to make the corresponding size
determination a bit safer according to the Linux coding style convention.

This issue was detected by using the Coccinelle software.

Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 08:48:47 -04:00
Markus Elfring c4cdcf9f1e media: usbvision: Adjust eight checks for null pointers
The script “checkpatch.pl” pointed information out like the following.

Comparison to NULL could be written !…

Thus fix the affected source code places.

Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 08:48:16 -04:00
Markus Elfring 3e7e9755c9 media: usbvision: Delete an error message for a failed memory allocation in usbvision_probe()
Omit an extra message for a memory allocation failure in this function.

This issue was detected by using the Coccinelle software.

Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 08:47:57 -04:00
Bhumika Goyal b104729e12 media: Staging: media: radio-bcm2048: make video_device const
Make this const as it is only used in a copy operation.

Signed-off-by: Bhumika Goyal <bhumirks@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 08:47:37 -04:00
Bhumika Goyal 96cc6956c6 media: radio: make video_device const
Make these const as they are only used in a copy operation.

Signed-off-by: Bhumika Goyal <bhumirks@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 08:47:20 -04:00
Dan Carpenter 47bdf7c6d6 media: dib8000: remove some bogus dead code
This function is broken.  It sets the wrong front_end to NULL.  But it's
not used, so let's just delete it.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 08:47:00 -04:00
Dan Carpenter 5af478341f media: dib9000: delete some unused broken code
The dib9000_remove_slave_frontend() function isn't used.

I was reviewing it because my static checker claims it writes one
element beyond the end of the array.  That's a false positive.  What it
actually does is, if there are two or more front ends, then it prints a
debug message to say that it removed the first one, stored in
state->fe[1], and then it "removes" (scare quotes on purpose) the second
one, stored in state->fe[2].  Deleting a front end from the middle is
not really supported and breaks code like dib9000_release() which
assumes the first NULL front end marks the end of the list.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 08:46:42 -04:00
Bhumika Goyal cd3bef00c2 media: staging: omap4iss: make v4l2_file_operations const
Make this const as it is only stored in a const field of a
video_device structure.

Signed-off-by: Bhumika Goyal <bhumirks@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 08:46:23 -04:00
Bhumika Goyal fe9619a7b5 media: usbtv: make v4l2_file_operations const
Make this const as it is only stored in a const field of a
video_device structure.

Signed-off-by: Bhumika Goyal <bhumirks@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 08:46:05 -04:00
Bhumika Goyal e66fb184e7 media: cx18: make v4l2_file_operations const
Make this const as it is only stored in a const field of a
video_device structure.

Signed-off-by: Bhumika Goyal <bhumirks@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 08:45:49 -04:00
Bhumika Goyal 8684494220 media: usb: make video_device const
Make these const as they are only used during a copy operation.

Signed-off-by: Bhumika Goyal <bhumirks@gmail.com>
Acked-by: Mike Isely <isely@pobox.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 08:45:32 -04:00
Bhumika Goyal 507e190946 media: pci: make video_device const
Make these const as they are either used during a copy operation or
passed to a const argument of the function cx88_vdev_init.

Signed-off-by: Bhumika Goyal <bhumirks@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 08:44:58 -04:00
Bhumika Goyal 5303135c17 media: platform: make video_device const
Make these const as they are only used during a copy operation.
Done using Coccinelle:

@match disable optional_qualifier@
identifier s;
@@
static struct video_device s = {...};

@ref@
position p;
identifier match.s;
@@
s@p

@good1@
identifier match.s;
expression list[3] es;
position ref.p;
@@
cx88_vdev_init(es,&s@p,...)

@good2@
position ref.p;
identifier match.s,f,c;
expression e;
@@
(
e = s@p
|
e = s@p.f
|
c(...,s@p.f,...)
|
c(...,s@p,...)
)

@bad depends on  !good1 && !good2@
position ref.p;
identifier match.s;
@@
s@p

@depends on forall !bad disable optional_qualifier@
identifier match.s;
@@
static
+ const
struct video_device s;

Signed-off-by: Bhumika Goyal <bhumirks@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 08:44:30 -04:00
Arnd Bergmann 3db4b68e46 media: au0828: fix RC_CORE dependency
When RC_CORE is a loadable module, and au0828 is built-in including
the RC support, we get a link error:

drivers/media/usb/au0828/au0828-input.o: In function `au0828_get_key_au8522':
au0828-input.c:(.text+0x474): undefined reference to `ir_raw_event_store'
drivers/media/usb/au0828/au0828-input.o: In function `au0828_rc_register':
au0828-input.c:(.text+0x7c8): undefined reference to `rc_allocate_device'
au0828-input.c:(.text+0x8f8): undefined reference to `rc_register_device'

This adds an additional dependency, similar to the one for em28xx,
to ensure the broken configuration is never used.

Fixes: 2fcfd317f6 ("[media] au0828: add support for IR on HVR-950Q")

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 08:35:35 -04:00
Gustavo A. R. Silva 87c0148671 media: dib0090: fix duplicated code for different branches
Refactor code in order to avoid identical code for different branches.

This issue was detected with the help of Coccinelle.

Addresses-Coverity-ID: 1226795

Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 07:51:30 -04:00
Fabio Estevam d4e192cc44 media: mx2_emmaprp: Check for platform_get_irq() error
platform_get_irq() may fail, so we should better check its return
value and propagate it in the case of error.

Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 07:50:48 -04:00
Sakari Ailus 3cdb977ec8 media: docs-rst: media: Document broken frame handling in stream stop for CSI-2
Some CSI-2 transmitters will finish an ongoing frame whereas others will
not. Document that receiver drivers should not assume a particular
behaviour but to work in both cases.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 07:11:11 -04:00
Daniel Scheller c67215263e media: dvb-frontends/stv0367: remove QAM_AUTO from ddb_fe_ops
Since the cab_* codepath doesn't recognize QAM_AUTO, don't announce that
it is supported when it really isn't. Fixes ie. w_scan from
unconditionally using QAM_AUTO on DVB-C scans.

Signed-off-by: Daniel Scheller <d.scheller@gmx.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 07:01:03 -04:00
Cihangir Akturk d60908759c media: imx: use setup_timer
Use setup_timer function instead of initializing timer with the
function and data fields.

Generated by: scripts/coccinelle/api/setup_timer.cocci.

Signed-off-by: Cihangir Akturk <cakturk@gmail.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Reviewed-by: Steve Longerbeam <steve_longerbeam@mentor.com>
Tested-by: Steve Longerbeam <steve_longerbeam@mentor.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 06:58:50 -04:00
Eugeniu Rosca 87e9201108 media: mxl111sf: Fix potential null pointer dereference
Reviewing the delta between cppcheck output of v4.9.39 and v4.9.40
stable updates, I stumbled on the new warning:

mxl111sf.c:80: (warning) Possible null pointer dereference: rbuf

Since copying state->rcvbuf into rbuf is not needed in the 'write-only'
scenario (i.e. calling mxl111sf_ctrl_msg() from mxl111sf_i2c_send_data()
or from mxl111sf_write_reg()), bypass memcpy() in this case.

Fixes: d90b336f3f ("[media] mxl111sf: Fix driver to use heap allocate buffers for USB messages")

Signed-off-by: Eugeniu Rosca <erosca@de.adit-jv.com>
Reviewed-by: Michael Ira Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 06:58:19 -04:00
Gustavo A. R. Silva 9793e1d214 media: au0828: fix unbalanced lock/unlock in au0828_usb_probe
Call mutex_unlock and free dev on failure.

Reported-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 06:57:33 -04:00
Anton Vasilyev be90cc8e4a media: dvb-usb: Add memory free on error path in dw2102_probe()
If dw2102_probe() fails on dvb_usb_device_init(), then memleak occurs.

The patch adds deallocation to the error path.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru>
Reviewed-by: Enrico Mioso <mrkiko.rs@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 06:57:13 -04:00
Daniel Scheller e5d9ce4dde media: dvb-frontends/stv0910: change minsymrate to 100Ksyms/s
The demodulator supports symbol rates as low as 100Ksyms/s - the demod
setup in start() already handles such low symbol rates and reviewers
of stv0910 equipped cards even found and tested transponders with
SRs in that range. So, announce this in the fe_ops.

Cc: Ralph Metzler <rjkm@metzlerbros.de>
Cc: Richard Scobie <r.scobie@clear.net.nz>
Signed-off-by: Daniel Scheller <d.scheller@gmx.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 06:42:53 -04:00
Daniel Scheller 2b64e4de39 media: staging/cxd2099: Add module parameter for buffer mode
The buffer mode of the cxd2099 driver requires more work regarding error
handling and thus can cause issues in some cases, so disable it by default
and make that mode of operation controllable by users via a module
parameter (ie. 'modprobe cxd2099 buffermode=1' enables current behaviour).

The upstream codebase also has the buffer mode disabled by default, so
we should match this (but users still can test things out using the
modparm).

Signed-off-by: Daniel Scheller <d.scheller@gmx.net>
Signed-off-by: Jasmin Jessich <jasmin@anw.at>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 06:42:31 -04:00
Daniel Scheller b5967860c6 media: ddbridge: fix sparse warnings
Fix several

  drivers/media/pci/ddbridge/ddbridge-core.c: warning: symbol ... was not declared. Should it be static?
  drivers/media/pci/ddbridge/ddbridge-core.c: warning: Using plain integer as NULL pointer
  drivers/media/pci/ddbridge/ddbridge-io.h: warning: cast removes address space of expression
  drivers/media/pci/ddbridge/ddbridge-io.h: warning: incorrect type in argument 1 (different address spaces)

at multiple places.

Cc: Ralph Metzler <rjkm@metzlerbros.de>
Signed-off-by: Daniel Scheller <d.scheller@gmx.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 06:36:34 -04:00
Daniel Scheller 1502efd2d5 media: ddbridge: fix teardown/deregistration order in ddb_input_detach()
Brought to attention by Matthias Schwarzott <zzam@gentoo.org> by fixing
possible use-after-free faults in some demod drivers:

In ddb_input_detach(), the i2c_client is unregistered and removed before
dvb frontends are unregistered and detached. While no use-after-free issue
was observed so far, there is another issue with this:

dvb->attached keeps track of the state of the input/output registration,
and the i2c_client unregistration takes place only if everything was
successful (dvb->attached == 0x31). If for some reason an error occurred
during the frontend setup, that value stays at 0x20. In the following
error handling and cleanup, ddb_input_detach() will skip down to that
state, leaving the i2c_client registered, causing refcount issues.

Fix this by moving the i2c_client deregistration down to case 0x20.

Cc: Matthias Schwarzott <zzam@gentoo.org>
Signed-off-by: Daniel Scheller <d.scheller@gmx.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 06:36:01 -04:00
Daniel Scheller 6b852620fa media: dvb-frontends/stv0910: release lock on gate_ctrl() failure
Whenever write_reg() fails to open/close the demod's I2C gate, release the
lock to avoid deadlocking situations. If I2c gate open failed, there's no
need to hold a lock, and if close fails, the mutex_unlock() at the end of
the function is never reached, leaving the mutex_lock in locked state,
which in turn will cause potential for deadlocks. Thus, release the lock
on failure.

While we're touching gate_ctrl(), add some explanation about the need for
locking and the shared I2C bus/gate.

Cc: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Daniel Scheller <d.scheller@gmx.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 06:35:13 -04:00
Matthias Schwarzott e59eb4adf0 media: cx231xx: fix use-after-free when unregistering the i2c_client for the dvb demod
Calling i2c_unregister_device for a demod driver destroys the frontend object.
Later it is accessed by calling dvb_unregister_frontend and
dvb_frontend_detach.

In some cases this leads to a general protection fault with this
callstack:

  dvb_unregister_frontend+0x25/0x50 [dvb_core]
  dvb_fini+0xdb/0x160 [cx231xx_dvb]
  cx231xx_unregister_extension+0x3d/0xb0 [cx231xx]
  cx231xx_dvb_unregister+0x10/0x809 [cx231xx_dvb]
  SyS_delete_module+0x18a/0x240
  ? exit_to_usermode_loop+0x7b/0x80
  entry_SYSCALL_64_fastpath+0x17/0x98

Signed-off-by: Matthias Schwarzott <zzam@gentoo.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 06:33:47 -04:00
Matthias Schwarzott 412b16d623 media: cx23885: Fix use-after-free when unregistering the i2c_client for the dvb demod
Unregistering the i2c_client of the demod driver destroys the frontend
object.
Calling vb2_dvb_unregister_bus later accesses the frontend (and with the
refcount_t) conversion the refcount_t code complains:

kernel: ------------[ cut here ]------------
kernel: WARNING: CPU: 0 PID: 7883 at lib/refcount.c:128 refcount_sub_and_test+0x70/0x80
kernel: refcount_t: underflow; use-after-free.
kernel: Modules linked in: bluetooth si2165(O) a8293(O) tda10071(O) tea5767(O) tuner(O) cx23885(O-) tda18271(O) videobuf2_dvb(O) videobuf2_dma_sg(O) m88ds3103(O) tveeprom(O) cx2341x(O) v4l2_common(O) dvb_core(O) rc_core(O) videobuf2_memops(O) videobuf2_v4l2(O) ums_realtek videobuf2_core(O) uas videodev(O) media(O) rtl8192cu i2c_mux usb_storage rtl_usb rtl8192c_common rtlwifi snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core x86_pkg_temp_thermal kvm_intel kvm irqbypass
kernel: CPU: 0 PID: 7883 Comm: rmmod Tainted: G        W  O    4.11.3-gentoo #3
kernel: Hardware name: MEDION E2050 2391/H81H3-EM2, BIOS H81EM2W08.308 08/25/2014
kernel: Call Trace:
kernel:  dump_stack+0x4d/0x66
kernel:  __warn+0xc6/0xe0
kernel:  warn_slowpath_fmt+0x46/0x50
kernel:  ? kobject_put+0x2f/0x60
kernel:  refcount_sub_and_test+0x70/0x80
kernel:  refcount_dec_and_test+0x11/0x20
kernel:  dvb_unregister_frontend+0x42/0x60 [dvb_core]
kernel:  vb2_dvb_dealloc_frontends+0x9e/0x100 [videobuf2_dvb]
kernel:  vb2_dvb_unregister_bus+0xd/0x20 [videobuf2_dvb]
kernel:  cx23885_dvb_unregister+0xc3/0x110 [cx23885]
kernel:  cx23885_dev_unregister+0xea/0x150 [cx23885]
kernel:  cx23885_finidev+0x4f/0x70 [cx23885]
kernel:  pci_device_remove+0x34/0xb0
kernel:  device_release_driver_internal+0x150/0x200
kernel:  driver_detach+0x33/0x70
kernel:  bus_remove_driver+0x47/0xa0
kernel:  driver_unregister+0x27/0x50
kernel:  pci_unregister_driver+0x34/0x90
kernel:  cx23885_fini+0x10/0x12 [cx23885]
kernel:  SyS_delete_module+0x166/0x220
kernel:  ? exit_to_usermode_loop+0x7b/0x80
kernel:  entry_SYSCALL_64_fastpath+0x17/0x98
kernel: RIP: 0033:0x7f5901680b07
kernel: RSP: 002b:00007ffdf6cdb028 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
kernel: RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f5901680b07
kernel: RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000000001500258
kernel: RBP: 00000000015001f0 R08: 0000000000000000 R09: 1999999999999999
kernel: R10: 0000000000000884 R11: 0000000000000206 R12: 00007ffdf6cda010
kernel: R13: 0000000000000000 R14: 00000000015001f0 R15: 00000000014ff010
kernel: ---[ end trace c3a4659b89086061 ]---

Signed-off-by: Matthias Schwarzott <zzam@gentoo.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 06:32:54 -04:00